Skip to main content
Version: 4.x

System Settings

Overview​

System / Settings holds the platform-wide settings, available to administrators only, organized in the tabs below.

Basic settings​

Basic settings

  • Service token: to use the built-in email and WeChat alert services and login MFA, follow the Spug WeChat official account, obtain a WeChat token and enter it here; otherwise leave it empty.

Security settings​

Security settings

  • Client IP verification: recommended. Checks whether the real client IP is available so that IP-based security still works behind a reverse proxy; a warning is shown on login when the check fails. It can be disabled for internal-only deployments, see Best practices.
  • Bind login to IP: strongly recommended. Login tokens are bound to the client IP and become invalid when used from another IP. Do not disable it unless you really have to.
  • Login MFA (two-factor): when enabled, a verification code sent to WeChat is required on login. Make sure the service token is set and your own account has a WeChat token before enabling it; enabling requires a successful code check, and every account needs a WeChat token to log in. If you get locked out, disable MFA from the command line, see below.

LDAP settings​

LDAP settings

  • Server / Bind DN / Password: the LDAP server used for lookups (e.g. ldap://ldap.example.com:389) and the bind account.
  • User OU: the OU that contains the users, e.g. ou=users,dc=example,dc=com.
  • User filter: the filter used to locate a user; it must contain the %(user)s placeholder, e.g. (cn=%(user)s), (uid=%(user)s) or (sAMAccountName=%(user)s).
  • Login name mapping / Name mapping: which LDAP attributes become the login name and display name of the Spug account, e.g. cn and sn.
  • Test: verify the settings with the login name and password of an LDAP user.
  • Import LDAP users: fetch the user list from LDAP and import the users as Spug accounts, then assign roles to them.

Afterwards choose LDAP login on the login page. An LDAP account is created in Spug automatically on its first login.

SSH key settings​

SSH key settings

Upload an existing key pair to use it as the global key. Without an uploaded key, Spug generates a key pair when the first host is added. RSA, Ed25519, ECDSA and DSA keys are supported; the generated key is a 2048-bit RSA key.

Note

After replacing the global key, hosts verified with the old key must be verified again.

Alert service settings​

Alert service settings

  • Mail service: used for email alerts. Built-in uses the mail service provided by Spug (requires the service token); Custom uses your own SMTP server with host, port, account, password / authorization code and sender name; ports 465 (SSL) and 587 are supported and Test sends a test mail.

Push service​

Push service

  • Push Assistant account: log in to Push Assistant, copy the user ID from Profile / Settings and enter it here; keep the ID secret. Once bound, the page shows the SMS, voice, email and WeChat official account balances, and the Push Assistant pipeline node can send messages to Push Assistant contacts; see the Push Assistant guide.

Open service settings​

Open service settings

About​

About

Shows the operating system, Python and Django versions and the Spug API and Spug Web versions; a warning appears when the two do not match (usually a browser refresh fixes it). Links to the documentation and change log are provided here; see Upgrade for upgrading.

Command line​

Besides the page, Spug provides the manage.py set command for some settings.

Disable login MFA​

If MFA codes cannot be received (for example because the WeChat token became invalid), disable MFA with manage.py set mfa disable:

cd spug/spug_api
source venv/bin/activate
python manage.py set mfa disable

With the Docker install:

docker exec spug python3 /data/spug/spug_api/manage.py set mfa disable